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DETAILED ACTION 

Election/Restrictions 

1 . Claims 1 5-1 7 and 25-28 are withdrawn from further consideration pursuant to 37 
CFR 1.142(b) as being drawn to a nonelected Group II, there being no allowable 
generic or linking claim. Election was made without traverse in the reply filed on 
10/07/2008. Claims 15-17 and 25-28 are were cancelled as well. 



Response to Arguments 

2. Applicant's arguments filed 04-08-2008 have been fully considered but they are 

not persuasive. Applicant's arguments with respect to claims 1-14, 19-24, and 29-36 

have been considered but are moot in view of the new interpretation of the prior art 

rejection necessitated by Applicant's amendments. Applicant's primary arguments with 

respect to claims 1 and 2 are related to the use of Table 1 . The rejection has been 

amended to better clarify a rejection based on Applicant's amended claims. In 

Applicant's characterization of new claim 1 , Applicant asserts: 

"By comparison. Applicant's probability of occurrence table as exemplified by 
Figures 6 and 9 and described at page 11, lines 3-22 and page 12, line 28 to 
page 13, line 1 and as recited in claim 1 as amended includes a plurality of risk 
categories, each category having a plurality of table entries, each entry including 
a category specific standardized qualitative probability definition associated with 
a Pf rating. The provision of multiple risk categories each having category- 
specific standardized qualitative definitions removes variability from the 
risk management process due to user subjectivity and replaces it with 
standardized definitions" 

However, Applicant's own specification appears to recite circumstances where 
individual users are able to provide the "standardized qualitative definitions" when 
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accessing the system. Without exhaustive study, some examples might include, pg. 5 
lines 26-31 to pg. 6, lines 1-4, for the proposition that new risks allow for the user to 
"augment their own knowledge and experience" to create an initial set of risks wherein 
the user "must assess each risk and assign a risk factor (Rf)." On pg 12, lines 25-31 to 
pg. 13, lines 1-2, which teaches that new risks will allow "the engineer" to "select the 
qualitative probability definitions 82 that most closely characterizes the risk thereby 
specifying the value 80 of Pf." Further, the engineer may select from the Severity of 
Consequence tables to create a severity value for each risk as on pg 19. These 
statements suggests some level of subjectivity in Applicant's invention. In fact, the 
"standardized definitions" have inherently been derived at some point in time and where 
likely subjective or derived from some history of information. However, in addressing 
Applicant's amendments, and in light of the newly amended rejection, it is the 
Examiner's position that the qualitative probability definitions are the "levels" in Table 1 , 
and they have an associated qualitative definition as indicated below in the prior art 
rejection as paragraphs [0033-0034] describe. 

In addressing Applicant's arguments with respect to Beverina Applicant states, 
"[bjeverina's tool gives the impression that it is web based when, in fact, it is not. Claim 
1 recites a 'web-browser' not a 'web-like browser.'" Please note Beverina at 
paragraphs, [001 5], [01 11-011 7], in particular the [0015] and [0111-0116], to include 
[0371]. 

In addressing claim 4, Examiner's Official Notice is based in fact on a 
comprehensive definition of the purpose of a Project Manager. An important aspect of 
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project management is controlling the inherent risks of a project. Risks arise from 
uncertainty surrounding project decisions and outcomes. Most individuals associate the 
concept of risk with the potential for loss in value, control, functionality, quality, or 
timeliness of completion of a project. However, project outcomes may also result in 
failure to maximize gain in an opportunity and the uncertainties in decision making 
leading up to this outcome can also be said to involve an element of risk. Project risk is 
broadly defined as any event or condition that can have a positive or negative impact on 
the outcome of a project. This wider concept of speculative risk is utilized by the 
financial industry where decisions regarding uncertainties may be associated with the 
potential for gain as well as losses, as opposed to the concept of pure risk used by the 
insurance industry where the uncertainties are associated with potential future losses 
only. In every field the project manager is responsible for accomplish a task on time. 
Therefore, when a project were to go overdue, they would be equally responsible for 
projecting timeframes and/or negative impacts on the project itself. 

In addressing claims 5-6, and 19, the Examiner has provided rejections based on 
Applicant's amendments to claims 5 and 6. With respect to claim 19, it is similarly the 
Examiner's position that there are similar limitations that have already been addressed 
in previous arguments and/or claims. In particular, it is asserted that claims 19-24, and 
34-36 are rejected under a similar rationale as that of the method claims. 

In addressing new claims 29-32 and 34-36, it is asserted that the inherent 
teachings of Abrahams itself render the limitations of these claims unpatentable. For 
example, as explained in the 101 rejection of record, Applicant's disclosure recites that 
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the risk mitigation is a product of a risk review board that looks to past risks and 
suggests new mitigation plans based on the old plans including preventative and 
corrective controls. In this respect, Abrahams in Figure 1 B shows a system by which 
existing risk records are used in profiles and new risk records are stored in a knowledge 
database for use by others. Abrahams states unequivocally in paragraph [0053] that 
the knowledge base learns over time thereby implying that his system is capable of 
being used to modify the overall process. Other similar recitations occur in paragraphs 
[0019], [0058], [0064], and [0070]. 



Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

4. Claims 1-14 and 29-33 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 

The first step in determining whether a claim recites patent eligible subject matter 
is to determine whether the claim falls within one of the four statutory categories of 
invention recited in 35 USC 101: process, machine, manufacture and composition of 
matter. The latter three categories define "things" or "products", while a "process" 
consists of a series of steps or acts to be performed. For purposes of 101 , the analysis 

of a process is guided by the machine-or-transformation test. In re Bilski, F.3d 

(Fed. Cir. 2008)(en banc). 
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Based on Supreme Court precedent (Diamond v Diehr, 450 U.S. 175,184 (1981); 
Parker v. Flook, 437 US 584, 588 n.9 (1978); Gottschalk v. Benson, 409 U.S. 63, 70 
(1972); Cochrane v. Deener, 94 U.S. 780, 787-88 (1876)) and recent precedent from 
the Federal Circuit from In re Bilski, the machine-or-transformation test is a two- 
branched inquiry; an applicant may show that a process claim satisfies § 101 either by 
showing that his claim is tied to a particular machine, or by showing that his claim 
transforms an article. See Benson, 409 U.S. at 70. Certain considerations are 
applicable to analysis under either branch. First, as illustrated by Benson, the use of a 
specific machine or transformation of an article must impose meaningful limits on the 
claim's scope to impart patent-eligibility. See Benson, 409 U.S. at 71-72. Second, the 
involvement of the machine or transformation in the claimed process must not merely 
be insignificant extra-solution activity. See Flook, 437 U.S. at 590. If neither of these 
requirements is met by the claim, the method is not a patent eligible process under 35 
U.S.C. 101. 

5. Claims 1-14 and 29-33 are drawn to a method for managing risk. All of the 

recited method steps can be performed by the user themselves, in the mind of the user 
or between different users through writing by a user, and therefor these method steps 
are not tied to a particular machine nor do they transform an article. To qualify as a 
statutory process, the claim should positively recite in the body of the claim, the 
machine to which it is tied. For example, by identifying the particular machine that 
accomplishes the method steps, or positively reciting the article that is being 
transformed. Furthermore, even if Applicant amends to identify a particular machine, in 
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the least, it appears that any claim recitation to a particular machine would only 
constitute "involvement" that is insignificant extra-solution activity. Evidence to support 
this assertion is found in the limitations themselves when Applicant recites the storing, 
data gathering/searching and viewing/displaying of information from the database. 
Additional evidence is found in Applicant's Specification when discussion claims 29-33, 
indicating that limitations including formulating and storing a new risk mitigation plan is 
done by a Risk Review Board (pgs. 13 and 14). This evidence indicates that the steps 
of formulating, and likely implementing are done by the users, administrative or 
otherwise. In short, the method steps of storing, formulating enterprise searches, 
viewing, formulating mitigation searches, formulating new mitigation plans, storing and 
implementing are all accomplished by the users or people and not a particular machine 
and are thus insignificant extra solution activity. 

Please note that nominal recitations of a machine in an otherwise ineligible 
method fail to make the method a statutory process. See Benson, 409 U.S. at 70 - 
72. As Comiskey recognized, "the mere use of the machine to collect data necessary 
for application of the mental process may not make the claim patentable subject 
matter." Comiskey, 499 F.3d at 1380 (citing In re Grams, 888 F.2d 835, 839-40 (Fed. 
Cir. 1989)). Incidental physical limitations, such as data gathering, field of use 
limitations, storing, collecting, sending, receiving, and other forms of insignificant extra 
solution activity are not enough to convert an abstract idea into a statutory process. In 
other words, nominal or token recitations of involvement of a machine or transformation 
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in a method claim do not convert an otherwise ineligible claim into an eligible one. Ex 
parte Langemyr (2008) and In re Bilski, (Fed. Cir. 2008). 

Therefore, the applicable test to determine whether a claim is drawn to a patent- 
eligible process under § 101 is the machine-or-transformation test set forth by the 
Supreme Court and clarified herein, and Applicants' claim here appears to fail this test. 
No new matter should be added. 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1-2, 7-11, 13-14 and 29-33 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Abrahams (2005/0086090) in view of Beverina 
(2001/0027389). 

8. As per claim 1, Abrahams teaches a method of managing risk related to a 
successful completion of a development project, comprising: 

storing a probability of occurrence (Pf) table having a plurality of risk categories 
(i.e. via Category 2 in Fig. 1 B, that shows an example of different Categories that 
contain sub-indented risk tables such as show in Table 1 , p. 4), each said category 
having a plurality of table entries (i.e. sub-indented risk tables), each entry including a 
category-specific standardized qualitative probability definition associated with a Pf 
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rating (i.e. via the risk tables described in Fig. 1C, para [0033-0034] the risk tables are 
described as actually being qualitative wherein the definition of each level in the table 
has a qualitative definition or value associated with it, while alternatively the qualitative 
values may be used directly by an experienced user,) and a severity of consequence 
(Cf) table (via Table 2, that shows an example of different risk consequences, Table 2, 
p. 4), identified risks and existing risk mitigation plans in a shared risk database (Fig. 1C 
shows a template for an identified risk, and control [mitigation] plans, said information 
must inherently be stored within a database); and viewing the Pf table to select a 
probability of occurrence Pf for said at least one risk; (via Table 1, that shows an 
example of different risk probabilities, Table 1, p. 4) 

viewing the Cf table to select a severity of consequence Cf for said at least one 
risk, (via Table 2, that shows an example of different risk consequences, Table 2, p. 4) 
said Pf and Cf being combined and ranked to define prioritized risk factor Rf (a user 
selects inherent values of likelihood [Pf] and consequence for a risk [Cf}, and ... the 
system then calculations residual levels of likelihood, consequence and risk rating for 
the risk [Pf], H 6, lines 6-1 1 ), Applicant should note that a similar argument could be 
made from the Context Profile data store wherein the hierarchy could allow for different 
risks to fall under different "profiles" (i.e. categories) in particular contexts. This is at 
least one other interpretation when the reference is given a full reading. 

However, Abrahams fails to explicitly disclose 

via a web browser, a plurality of users, formulating an enterprise search of the 
risk database to identify at least one risk. 
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Beverina in the same field of endeavor [risk management systems] teaches a 
web browser (Fig. 3), a plurality of users (Fig. 1), formulating an enterprise search of the 
risk database to identify at least one risk (via 1f 361 , "the user can also search the sites 
for particular information" where the particular information is a risk, and formulating a 
mitigation search of the risk database to identify existing risk mitigation plans for the 
identified risk to enhance the development of new mitigation plans or share with other 
programs the resources to implement the mitigation plan, (via "risk mitigation [that] also 
uses threat and countermeasure characteristics in making decisions. Various 
countermeasures are compared to the specific threat to determine which ones are most 
effective at mitigating the risk of the threat against the target", Examiner construes this 
to be the equivalent of a mitigation plan search as it evaluates existing plans to provide 
the user with the best alternatives. |f 307, lines 9-13) 

It would have been obvious to one skilled in the art at the time of invention to 
combine the risk management system taught by Abrahams with the risk management 
system features of Beverina. Motivation for the combination is a system with more 
features that should produce better risk management analysis and techniques. 
9. As per claim 2, Abrahams teaches the method wherein the probability of 
occurrence table has a plurality of risk categories, each said category having table 
entries that include standardized qualitative probability definitions, (via Table 1, p. 4, 
that shows the plurality of categories ranging from rare to almost certain, and the 
standardized qualitative probability definitions for each category of risk) Regardless, 
even though the combination fails to disclose the use of cost and schedule impact 
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categories, the specific type of categories are deemed to be nonfunctional descriptive 
material and is not functionally involved in the steps recited. The storing, formulating 
and viewing steps would be performed the same regardless of what type of categories 
are used. Thus this descriptive material will not distinguish the claimed invention from 
the prior art in terms of patentability, see In re Gulack, 703 F .2d 1381, 1385, 217 USPQ 
401, 404 (Fed.Cir.1983); In re Lowry, 32 F .3d 1579, 32 USPQ2d 1031 (Fed. Cir. 1994) 
and MPEP 2106.01. 

1 0. As per claim 7, Abrahams fails to explicitly disclose the method wherein the 
enterprise search includes a combination of at least two parameters including current or 
historic, risk factor, vendor, component, functional area, category, key work in risk title, 
key work in risk description, IPT, actionee, actionee/team, lead/submitter, or risk 
number. However, Beverina, in the same field of endeavor [risk management systems], 
teaches searches "by categories such as threat type, risk, score and others" flj 363, 
lines 3-5). Examiner construes risk to be the current risk factor, and threat type to be 
the category. It would have been obvious to one skilled in the art at the time of 
invention to combine the risk management system taught by Abrahams with the risk 
management system search features of Beverina. Motivation for the combination is a 
system where users have easier access to past records, and therefore can use past 
results easier. 

11. As per claim 8, Abrahams teaches at least one risk including a combination of 
risk number, program, risk title and a current risk factor (Fig. 1 B displays the risk 
number next to the risk, and a program is detailed under each consequence [Examiner 
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construes a program to be a series of steps, in this case the program is the corrective 
controls], Fig. 1C displays the title, as well as the risk rating). However, Abrahams fails 
to explicitly disclose that this information is retrieved via a search. Beverina, in the 
same field of endeavor [risk management systems], teaches searches "by categories 
such as threat type, risk, score and others" (1f 363, lines 3-5). It would have been 
obvious to one skilled in the art at the time of invention to combine the risk management 
system taught by Abrahams with the risk management system search features of 
Beverina. Motivation for the combination is a system where users have easier access 
to past records, and therefore can use past results easier. 

12. As per claim 9, Abrahams fails to explicitly disclose the method wherein the web 
browser provides a transfer link from said at least one risk with its risk mitigation plan to 
import the selected risk and mitigation plan into another program. However, Beverina, 
in the same field of endeavor [risk management systems], teaches that "Results from 
local VAT 200 sessions are transferred to the TIMS 130, in the form of the VAT 
Database 220, and stored in a database along with sessions from other sites." (H 364) 
Fig. 1 further illustrates this detail as risk mitigation plans are created and stored, until 
they are imported into the TIMS program. It would have been obvious to one skilled in 
the art at the time of invention to combine the risk management system taught by 
Abrahams with the risk management system features of Beverina. Motivation for the 
combination is a system with more features that should produce better risk 
management analysis and techniques. 
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1 3. As per claim 10, Abrahams fails to explicitly disclose the method wherein the 
mitigation search includes a combination of at least two parameters including a risk 
description, risk status, start date, original planned complete date, planned complete 
date, and complete date. However, Beverina, in the same field of endeavor [risk 
management systems], teaches that users can "search and browse the data from the 
individual VAT 200 sessions by categories such as threat type, risk, score and others." 

363) Figure 50 shows a calendar within that VAT 200 for entry of start and 
completion dates. A user therefore, would be able to do a mitigation search including 
the parameters of start date and complete date. It would have been obvious to one 
skilled in the art at the time of invention to combine the risk management system taught 
by Abrahams with the risk management system features of Beverina. Motivation for the 
combination is a system with more features that should produce better risk 
management analysis and techniques. 

14. As per claim 1 1 , Abrahams fails to explicitly disclose the method further 
including automatically generating risk reports including identified risks, prioritized risk 
factors, and mitigation plans. However, Beverina, in the same field of endeavor [risk 
management systems], teaches that users can "create, edit and delete report formats to 
create new and customized reports to meet future needs" (H 374, lines 6-7). A user 
would be enabled to create risk reports including the identified risk, prioritized risk 
factors, and mitigation plans. It would have been obvious to one skilled in the art at the 
time of invention to combine the risk management system taught by Abrahams with the 
risk management reporting feature of Beverina. Motivation for the combination is a 
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system with more features that should produce better risk management analysis and 
techniques as well as easier sharing of information. 

1 5. As per claim 13, Abrahams fails to explicitly disclose the method wherein the 
web browser has an interface that includes a menu bar with pull-down menu items and 
menu sub-items for viewing the current program, conducting the enterprise search and 
conducting the mitigation search and hyperlinks to the Pf and Cf tables. However, 
Beverina, in the same field of endeavor [risk management systems] teaches a web 
browser (Fig. 3), with pull-down menu items [viewable in the drawing] and menu sub- 
items for viewing the current program [viewable in the drawing], conducting the 
enterprise search [via the search box] and conducting the mitigation search [via the 
search box] and hyperlinks to the Pf and Cf tables [via the THREATS and 
VULNERABILITY hyperlinks in the drawing]. It would have been obvious to one skilled 
in the art at the time of invention to combine the risk management system taught by 
Abrahams with the web based feature of Beverina. Motivation for the combination is a 
system with more features that should produce better risk management analysis and 
techniques as well as easier navigation of information. 

16. As per claim 14, Abrahams teaches the method wherein the identified risks, risk 
factors, and mitigation plans for each user are stored in the shared risk database. 
Figure 1B shows the "knowledge base" construed by Examiner to be a database, 
containing identified risks, risk factors, and mitigation plans [Examiner construes the 
corrective control and the preventative control to be a mitigation plan]. 
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17. As per claim 29, it is asserted that Abrahams teaches formulating a mitigation 
search of the risk database to identify existing risk mitigation plans for the identified risk 
to enhance the development of new mitigation plans or share with other programs the 
resources to implement the mitigation plan. 

In addressing new claims 29-32 and 34-36, it is asserted that the inherent 
teachings of Abrahams itself render the limitations of these claims unpatentable. For 
example, as explained in the 101 rejection of record, Applicant's disclosure recites that 
the risk mitigation is a product of a risk review board that looks to past risks and 
suggests new mitigation plans based on the old plans including preventative and 
corrective controls. In this respect, Abrahams in Figure 1 B shows a system by which 
existing risk records are used in profiles and new risk records are stored in a knowledge 
database for use by others. Abrahams states unequivocally in paragraph [0053] that 
the knowledge base learns over time thereby implying that his system is capable of 
being used to modify the overall process. Other similar recitations occur in paragraphs 
[0019], [0058], [0064], and [0070]. 

If Applicant disagrees with the Examiner's interpretation of Abrahams, then 
Beverina in the same field of endeavor [risk management systems] teaches a web 
browser (Fig. 3), a plurality of users (Fig. 1), formulating an enterprise search of the risk 
database to identify at least one risk (via If 361 , "the user can also search the sites for 
particular information" where the particular information is a risk, and formulating a 
mitigation search of the risk database to identify existing risk mitigation plans for the 
identified risk to enhance the development of new mitigation plans or share with other 



Application/Control Number: 10/661,756 Page 16 

Art Unit: 3629 

programs the resources to implement the mitigation plan, (via "risk mitigation [that] also 
uses threat and countermeasure characteristics in making decisions. Various 
countermeasures are compared to the specific threat to determine which ones are most 
effective at mitigating the risk of the threat against the target", Examiner construes this 
to be the equivalent of a mitigation plan search as it evaluates existing plans to provide 
the user with the best alternatives, 307, lines 9-13) 

It would have been obvious to one skilled in the art at the time of invention to 
combine the risk management system taught by Abrahams with the risk management 
system features of Beverina. Motivation for the combination is a system with more 
features that should produce better risk management analysis and techniques. 

18. As per claim 30, Abrahams and Beverina teach the method of claim 29, wherein 
the mitigation search identifies both successful and unsuccessful existing risk mitigation 
plans, (i.e. at least Abrahams and/or Beverina teach that the plans are stored, and 
therefore by that very nature both good and bad plans will be accessible wherein the 
knowledge base collects new risk records wherein the risk records include the mitigation 
or preventative and corrective controls.) 

1 9. As per claim 31 , Abrahams and Beverina teach the method of claim 29, further 
comprising: aggregating the risk mitigation plans from a plurality of different users and 
different programs to update and store a risk mitigation plan on the shared database, 
(i.e. as taught by at least Abrahams wherein the knowledge base collects new risk 
records wherein the risk records include the mitigation or preventative and corrective 
controls.) 



Application/Control Number: 10/661,756 Page 17 

Art Unit: 3629 

20. As per claim 32, Abrahams and Beverina teach the method of claim 29, further 
comprising: sharing resources with other programs to implement the mitigation plan, 
(i.e. in the least via the use over the internet which inherently interacts with other 
programs, such as user interfaces.) 

21 . As per claim 33, Abrahams and Beverina teach the method of claim 29, where 
the risk mitigation plan includes a number of activities, each activity including a 
description and an assigned Pf and Cf rating, (i.e. this assignment is inherent in the 
methods described in the prior art, since each project will include categories and risks 
that will have associated Pf and Cf ratings when they have already been performed and 
placed in the knowledge database. Essentially, projects already completed will have 
been given ratings.) 

22. Claims 3-6 and 12, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Abrahams (2005/0086090) and Beverina (2001/0027389) in view 
of Examiner's Official Notice. 

23. As per claim 3, Abrahams discloses the method further comprising tailoring the 
probability of occurrence table to the select few categories that are relevant to the 
development project, (i.e. it is inherent in the teaching of Abrahams that a user may 
reduce or add more categories depending on the project or the number of categories 
one wishes to consider. Subsequently, any associated Pf tables as described in claim 1 
would be on the shared risk database in Fig. 1 B.) However, Abrahams fails to 
explicitly disclose that this is done via a web browser. Beverina, in the same field of 
endeavor [risk management systems], teaches a browser based risk management 
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system. It would have been obvious to one skilled in the art at the time of the invention 
to use the system taught by Abrahams in a web based environment as taught by 
Beverina. Motivation to combine the two is present as a web based risk management 
system allows users in remote locations to easily modify and update risk profiles. 
Furthermore, the use or restriction of user access, or limiting access to an administrator 
is well known in the art of computer programming. Several systems such as Microsoft 
operating systems use such features to limit access for users. Similarly there are 
security programs that operate in similar fashion for the proposition of preventing 
access to certain features of an operating system. Examiner takes Official Notice with 
respect to administrative access to a system. 

24. As per claim 4, the combination of Abrahams and Beverina teaches the claimed 
invention as mentioned in claim 1, above. Abrahams further teaches the method 
wherein the severity of consequence table has a schedule impact category with the 
table entries having a cost impact category with the table entries specifying multiple 
sub-categories of cost impacts in actual dollars for the development project. (Table 2, 
p. 4) However, the Abrahams and Beverina combination fails to explicitly disclose table 
entries specifying an amount in days, weeks or months. Examiner takes Official Notice 
that it is old and well known in the art of project management to measure negative 
impacts upon projects like delays in units of time such as days, weeks, or months. It 
would have been obvious to one skilled in the art at the time of invention to combine the 
table taught by Abrahams and Beverina with Examiner's Official Notice. Motivation to 
combine is to have an additional quantifiable way to measure consequences of a 
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particular outcome. Regardless, even though the combination fails to disclose the use 
of cost and schedule impact categories, the specific type of categories are deemed to 
be nonfunctional descriptive material and is not functionally involved in the steps 
recited. The storing, formulating and viewing steps would be performed the same 
regardless of what type of categories are used. Thus this descriptive material will not 
distinguish the claimed invention from the prior art in terms of patentability, see In re 
Gulack, 703 F .2d 1381, 1385, 217 USPQ 401, 404 (Fed.Cir.1983); In re Lowry, 32 F 
.3d 1579, 32 USPQ2d 1031 (Fed. Cir. 1994) and MPEP 2106.01. 
25. As per claim 5, Abrahams teaches the method wherein said multiple sub- 
categories include development cost (NRE), unit cost (DTC) and operations and support 
(O/S) categories, (via "in one mode of use, the inherent risk impact cost is aggregated 
over the inherent cost of each consequence of the risk" where consequences of each 
risk would inherently include development cost, unit cost, and operations and support 
costs, U 7, lines 15-17). Regardless, even though the combination fails to disclose the 
use of multiple sub-impact categories, the specific type of categories are deemed to be 
nonfunctional descriptive material and is not functionally involved in the steps recited. 
The storing, formulating and viewing steps would be performed the same regardless of 
what type of categories are used. Thus this descriptive material will not distinguish the 
claimed invention from the prior art in terms of patentability, see In re Gulack, 703 F .2d 
1 381 , 1 385, 217 USPQ 401 , 404 (Fed.Cir.1 983); In re Lowry, 32 F .3d 1 579, 32 
USPQ2d 1031 (Fed. Cir. 1994) and MPEP 2106.01. 
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26. As per claim 6, the combination of Abrahams and Beverina and Examiner's 
Official Notice teaches the claimed invention as mentioned in claim 4, above. 
Abrahams further teaches the method further comprising the severity of consequence 
table to select the cost impact sub-categories and specify their dollar amounts (Table 2, 
p. 4 shows the severity of consequence table which includes cost impact sub-categories 
and dollar ranges.) Abrahams further teaches a shared risk database for storage as 
shown in Fig. 1 B, element 1 1 . Furthermore, the use or restriction of user access, or 
limiting access to an administrator is well known in the art of computer programming. 
Several systems such as Microsoft operating systems use such features to limit access 
for users. Similarly there are security programs that operate in similar fashion for the 
proposition of preventing access to certain features of an operating system. Examiner 
takes Official Notice with respect to administrative access to a system. With respect to 
the specifics of the sub-categories, the specific type of categories are deemed to be 
nonfunctional descriptive material and is not functionally involved in the steps recited. 
The storing, formulating and viewing steps would be performed the same regardless of 
what type of categories are used. Thus this descriptive material will not distinguish the 
claimed invention from the prior art in terms of patentability, see In re Gulack, 703 F .2d 
1381, 1385, 217 USPQ 401,404 (Fed.Cir.1983); In re Lowry, 32 F .3d 1579, 32 
USPQ2d 1031 (Fed. Cir. 1994) and MPEP 2106.01. 

27. As per claim 12, the combination of Abrahams and Beverina teaches the 
claimed invention as mentioned in claim 11, above. However, the Abrahams and 
Beverina combination fails to explicitly teach the method wherein a risk review board 



Application/Control Number: 1 0/661 ,756 Page 21 

Art Unit: 3629 

(RRB) report is generated by submitting minutes for a RRB meeting by entering 
information for each risk covered during a RRB meeting and entering the date of the 
RRB meeting; and submitting the minutes to generate the RRB report including 
Number, Title, Actionee, Rf, Risk Level and Comments for each risk. Examiner takes 
Official Notice that it is old and well known in the art of meetings to generate and submit 
minutes. Examiner further takes Official Notice that it is old and well known in the art of 
recording minutes to record topics discussed as well as the date of the meeting. 
Beverina, teaches that clauses of a report can include "Data values in the database and 
results from simple queries of the database that return text or simple data values" (U 
429-432). These results would include information such as Risk Factors, Risk Level 
and Comments. It would have been obvious to one skilled in the art at the time of 
invention to combine the system of Abrahams with the reporting features of Beverina in 
view of Examiner's Official Notice. Motivation to combine is increased communication 
within a risk management setting. 

28. Claims 19-20, 22-24 and 34-36 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Abrahams (2005/0086090) and Beverina (2001/0027389) in view 
of Heinrich (6,895,383). 

29. As per claim 19, Abrahams teaches a web-based risk management system for 
managing risk related to a successful completion of a development project, comprising: 

a server comprising a shared risk database that stores a probability of 
occurrence (Pf) table (via Table 1, that shows an example of different risk probabilities, 
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Table 1 , p. 4) and a severity of consequence (Cf) table (via Table 2, that shows an 
example of different risk consequences, Table 2, p. 4), risk identification information and 
risk mitigation information (Fig. 1C shows a template for an identified risk, and control 
[mitigation] plans, where said information must inherently be stored within a database); 

However, Abrahams fails to explicitly disclose a web-based risk management 
tool on the server that provides standardized interfaces for searching, viewing and 
entering information to and from the shared risk database via a web browser, an 
intranet, and a plurality of computer workstations in communication with the server via 
the intranet, each said workstation provided with a web browser to search the database 
using the standardized interfaces to identify risks, to select entries from the Pf and Cf 
tables to calculate and prioritize a risk factor Rf for each risk, and to search the 
database to identify existing risk mitigation plans for the prioritized risks. 

Beverina, in the same field of endeavor [risk management systems] teaches 
each said work station provided with a web browser to search the database using the 
standardized interfaces to identify risks (Fig. 3), to select entries from the Pf and Cf 
tables [via the THREATS and VULNERABILITY hyperlinks in the drawing], to calculate 
and prioritize a risk factor Rf for each risk (where the calculation is accomplished by 
"calculating a probability that an event will occur; calculating a vulnerability to the event; 
and calculating a relative risk based on the probability and vulnerability", Claim 13, and 
prioritizing a risk factor is done by "clicking on a column heading will sort and group the 
table based on that column", Fig. 16). It would have been obvious to one skilled in the 
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art at the time of invention to combine the system taught by Abrahams with the browser 
abilities of Beverina. Motivation to combine is easier access to the system. 

However, Abrahams and Beverina both fail to disclose an intranet and a plurality 
of workstations in communication with the server via the intranet. Heinrich, in the same 
field of endeavor [risk management] teaches "a system containing a user computer, a 
network, and a security computer", (Col. 15, lines 46-47) and that the network "may also 
represent a corporate extranet or intranet" (Col. 15, lines 53-55). It would have been 
obvious to one skilled in the art at the time of invention to combine the combination of 
Abrahams and Beverina with the network of Heinrich. Motivation for the combination is 
to create a risk management system with easy system interaction and easy user 
communication. 

30. As per claim 20, Abrahams fails to explicitly disclose the method wherein the 
web browser has an interface that includes a menu bar with pull-down menu items and 
menu sub-items for viewing the current program, conducting the enterprise search and 
conducting the mitigation search and hyperlinks to the Pf and Cf tables. However, 
Beverina, in the same field of endeavor [risk management systems] teaches a web 
browser (Fig. 3), with pull-down menu items [viewable in the drawing] and menu sub- 
items for viewing the current program [viewable in the drawing], conducting the 
enterprise search [via the search box] and conducting the mitigation search [via the 
search box] and hyperlinks to the Pf and Cf tables [via the THREATS and 
VULNERABILITY hyperlinks in the drawing]. It would have been obvious to one skilled 
in the art at the time of invention to combine the risk management system taught by 
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Abrahams with the web based feature of Beverina. Motivation for the combination is a 
system with more features that should produce better risk management analysis and 
techniques as well as easier navigation of information. 

31 . As per claim 22, the Abrahams and Heinrich combination fails to explicitly 
disclose the system wherein the workstation via the web browser submits an enterprise 
search that includes a combination of at least two parameters including current or 
historic, risk factor, vendor, component, functional area, category, key word in risk title, 
key word in risk description, IPT, actionee, actionee/team lead/submitter or risk number 
and the server returns via the web browser an enterprise search results list including for 
at least one risk a combination of risk number, program, risk title, a current risk factor 
and its risk mitigation plan.. However, Beverina, in the same field of endeavor [risk 
management systems], teaches searches "by categories such as threat type, risk, score 
and others". Examiner construes risk to be the current risk factor, and threat type to be 
the category. Beverina further teaches that users can "search and browse the data 
from the individual VAT 200 sessions by categories such as threat type, risk, score and 
others." fl[ 363) Figure 50 shows a calendar within that VAT 200 for entry of start and 
completion dates. A user therefore, would be able to do a mitigation search including 
the parameters of start date and complete date. Finally, Beverina teaches a web 
browser enterprise search (Fig. 3 via the search option). It would have been obvious to 
one skilled in the art at the time of invention to combine the system of Abrahams and 
Heinrich with the tools of Beverina. Motivation to combine is creation of a risk 
management system with easier access to information and ease of modification. 
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32. As per claim 23, the Abrahams and Heinrich combination fails to explicitly 
disclose the system wherein the workstation via the web browser submits a mitigation 
search that includes a combination of at least two parameters including a risk 
description, risk status, start date, original planned complete date, planned complete 
date and complete date and the server returns existing mitigation plans that satisfy the 
search parameters. However, Beverina, in the same field of endeavor [risk 
management systems], teaches that users can "search and browse the data from the 
individual VAT 200 sessions by categories such as threat type, risk, score and others." 
(If 363) Figure 50 shows a calendar within that VAT 200 for entry of start and 
completion dates. A user therefore, would be able to do a mitigation search including 
the parameters of start date and complete date. It would have been obvious to one 
skilled in the art at the time of invention to combine the risk management system taught 
by Abrahams and Heinrich with the risk management system features of Beverina. 
Motivation for the combination is a system with more features that should produce 
better risk management analysis and techniques. 

33. As per claim 24, the Abrahams and Heinrich combination fails to explicitly 
disclose the system wherein the workstations automatically submit identified risks, risk 
factors and mitigation plans to the shared database, said server automatically 
generating risk reports including identified risks, prioritized risk factors and mitigation 
plans for the current project. However, Beverina, in the same field of endeavor [risk 
management systems], teaches that users can "create, edit and delete report formats to 
create new and customized reports to meet future needs" fl[ 374, lines 6-7). A user 
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would be enabled to create risk reports including the identified risk, prioritized risk 
factors, and mitigation plans. It would have been obvious to one skilled in the art at the 
time of invention to combine the risk management system taught by Abrahams and 
Heinrich with the risk management reporting feature of Beverina. Motivation for the 
combination is a system with more features that should produce better risk 
management analysis and techniques as well as easier sharing of information. 

34. As per claim 34, Abrahams, Berverina and Heinrich teach the system of claim 
19, wherein existing risk mitigation plans for different risks are stored in the shared 
database, said web browser configured to formulate a mitigation search of the risk 
database to identify existing risk mitigation plans for the identified risk, formulate a new 
risk mitigation plan that's builds upon the one or more existing risk mitigation plans, and 
store the new risk mitigation plan on the shared database. Claim 34 is rejected under a 
similar rationale as that of claim 29 supra. 

35. As per claim 35, Abrahams, Berverina and Heinrich teach the system of claim 
34, wherein the mitigation search identifies both successful and unsuccessful existing 
risk mitigation plans. Claim 35 is rejected under a similar rationale as that of claim 30. 

36. As per claim 36, Abrahams, Berverina and Heinrich teach the system of claim 
34, wherein the web browser facilitates sharing resources with other programs to 
implement the mitigation plan. Claim 36 is rejected under a similar rationale as that of 
claim 32. 
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37. Claim 21 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Abrahams (2005/0086090), Beverina (2001/0027389), and Heinrich (6,895,383) in 
view of Examiner's Official Notice. 

38. As per claim 21 , the combination of Abrahams, Beverina and Heinrich teaches 
the claimed invention as mentioned in claim 19, above. Abrahams further teaches the 
system wherein the PF table has a plurality of risk categories, each said category 
having table entries that include standardized qualitative probability definitions (via 
Table 1, that shows an example of different risk probabilities, Table 1, p. 4) and the Cf 
table having a cost impact category with table entries for specifying multiple sub- 
categories of cost impacts in actual dollars for the development project, (via Table 2, 
that shows an example of different sub-categories, Table 2, p. 4) and tailoring the Pf 
table to have few categories that are relevant to the current project (fl 6, lines 7-8 teach 
that a user can select inherent values of likelihood and consequence for a risk [this data 
coming from Table 1 on p. 4]). 

However, the Abrahams, Beverina and Heinrich combination fails to teach a schedule 
impact category with table entries for specifying a schedule impact amount in days, 
weeks or months and a web browser providing administrative access. 

Examiner takes Official Notice that it is old and well known in the art of project 
management to measure negative impacts upon projects like delays in units of time 
such as days, weeks, or months. It would have been obvious to one skilled in the art at 
the time of invention to combine the table taught by Abrahams and Heinrich with 
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Examiner's Official Notice. Motivation to combine is to have an additional quantifiable 
way to measure consequences of a particular outcome. 

Beverina, further teaches a web browser (Fig. 3), and administrative access (via 
Fig. 1 where the Senior Commander is the administrative access). It would have been 
obvious to one skilled in the art at the time of invention to combine the system of 
Abrahams, Beverina, and Heinrich in view of Examiner's Official Notice with the 
additional features of Beverina. Motivation to combine is to create a risk management 
system with more detailed information and easier access. 



Conclusion 

39. The Examiner has pointed out particular references contained in the prior art of 
record, within the body of this action for the convenience of the Applicant. Although the 
specified citations are representative of the teachings in the art and are applied to the 
specific limitations within the individual claim, other passages and figures may apply. 
Applicant, in preparing the response, should consider fully the entire reference as 
potentially teaching all or part of the claimed invention, as well as the context of the 
passage as taught by the prior art or disclosed by the Examiner. 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael M. Thompson whose telephone number is (571) 
270-3605. The examiner can normally be reached on Monday thru Friday 8am-5:30 
except Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Weiss can be reached on (571) 272-6812. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Michael M Thompson/ 
Examiner, Art Unit 3629 

/John G. Weiss/ 

Supervisory Patent Examiner, Art Unit 3629 



